diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 960d3861c..a4f0665b8 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -1,5 +1,4 @@ import logging -import os.path as os_path import typing from volatility.framework import constants, exceptions, interfaces, objects @@ -31,12 +30,10 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): self._hive_offset = self.config["hive_offset"] self._table_name = self.config["nt_symbols"] - self._reg_table_name = context.symbol_space.free_table_name("registry") - - reg_path = "file://" + os_path.join(os_path.dirname(__file__), '..', 'symbols', 'windows', 'reg.json') - table = intermed.IntermediateSymbolTable(context = context, config_path = config_path, - name = self._reg_table_name, isf_url = reg_path) - context.symbol_space.append(table) + self._reg_table_name = intermed.IntermediateSymbolTable.create(context, + self._config_path, + 'windows', + 'registry') self.hive = self.context.object(self._table_name + constants.BANG + "_CMHIVE", self._base_layer, self._hive_offset).Hive diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 9abf148ca..ded5a90a2 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -156,6 +156,23 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): if name.endswith(filename + extension) or (filename == "*" and name.endswith(extension)): yield "jar:file:" + str(pathlib.Path(zip_path)) + "!" + name + @classmethod + def create(cls, + context: interfaces.context.ContextInterface, + config_path: str, + sub_path: str, + filename: str) -> str: + """Takes a context and loads an intermediate symbol table based on a filename. + + Returns the name of the added symbol table""" + urls = list(cls.file_symbol_url(sub_path, filename)) + if not urls: + raise ValueError("No symbol files found at provided filename: {}", filename) + table_name = context.symbol_space.free_table_name(filename) + table = cls(context = context, config_path = config_path, name = table_name, isf_url = urls[0]) + context.symbol_space.append(table) + return table_name + class ISFormatTable(interfaces.symbols.SymbolTableInterface, metaclass = ABCMeta): """Provide a base class to identify all subclasses""" diff --git a/volatility/framework/symbols/windows/reg.json b/volatility/framework/symbols/windows/registry.json similarity index 100% rename from volatility/framework/symbols/windows/reg.json rename to volatility/framework/symbols/windows/registry.json